Question 350 A team wants to discuss responsibilities and decisions before attempting a risky live failover. Which test is appropriate? Exercise leadership decisions, stakeholder communication and cross-team coordination Conduct a controlled parallel recovery test with independent processing comparison Run a facilitated tabletop scenario with relevant technical and business participants Plan graduated exercises with approved safety boundaries, rollback and measurable objectives Explanation Correct Answer C:Tabletops validate coordination and decision paths with low operational disruption. Incorrect Answers A:Business continuity success depends on governance and people as well as systems; it is relevant where a company tests only technology failover but ignores executive crisis communications, whereas the current facts require run a facilitated tabletop scenario with relevant technical and business participants to address the stated problem. B:Parallel tests exercise the alternate environment without intentionally interrupting primary service; it is relevant where a regulator wants proof that the organization can operate from its alternate data center while the primary remains live, whereas the current facts require run a facilitated tabletop scenario with relevant technical and business participants to address the stated problem. D:The other scenario states that a firm claims its DR plan works after an unannounced production cutover fails and no rollback exists, where full-interruption tests need robust authorization and recovery controls, not improvisation; by contrast, the present case requires run a facilitated tabletop scenario with relevant technical and business participants.
Question 351 A firm claims its DR plan works after an unannounced production cutover fails and no rollback exists. What should testing governance require? Plan graduated exercises with approved safety boundaries, rollback and measurable objectives Run a facilitated tabletop scenario with relevant technical and business participants Confirm the asset's exposure and remove unnecessary connectivity or decommission it Conduct a controlled parallel recovery test with independent processing comparison Explanation Correct Answer A:Full-interruption tests need robust authorization and recovery controls, not improvisation. Incorrect Answers B:Tabletops validate coordination and decision paths with low operational disruption; although this helps when a team wants to discuss responsibilities and decisions before attempting a risky live failover, it leaves the current case's need to plan graduated exercises with approved safety boundaries, rollback and measurable objectives unresolved. C:For the separate situation in which a scanner finds a vulnerability in a retired asset still connected to production, risk treatment may be faster and more effective than patching an obsolete asset; here the stated problem requires plan graduated exercises with approved safety boundaries, rollback and measurable objectives. D:Parallel tests exercise the alternate environment without intentionally interrupting primary service; it is relevant where a regulator wants proof that the organization can operate from its alternate data center while the primary remains live, whereas the current facts require plan graduated exercises with approved safety boundaries, rollback and measurable objectives to address the stated problem.
Question 352 A hospital's IT recovery plan restores servers but clinical staff cannot continue care without manual intake forms. What is missing? Integrate business continuity workarounds and people processes with technical recovery Plan graduated exercises with approved safety boundaries, rollback and measurable objectives Include critical suppliers and alternative logistics arrangements in BC scenario testing Exercise leadership decisions, stakeholder communication and cross-team coordination Explanation Correct Answer A:BC covers service delivery when applications or facilities are unavailable. Incorrect Answers B:Full-interruption tests need robust authorization and recovery controls, not improvisation; although this helps when a firm claims its DR plan works after an unannounced production cutover fails and no rollback exists, it leaves the current case's need to integrate business continuity workarounds and people processes with technical recovery unresolved. C:External dependencies can stop business operations despite successful internal recovery; it is relevant where a distribution business relies on a single external warehouse that never joins continuity exercises, whereas the current facts require integrate business continuity workarounds and people processes with technical recovery to address the stated problem. D:Business continuity success depends on governance and people as well as systems; it is relevant where a company tests only technology failover but ignores executive crisis communications, whereas the current facts require integrate business continuity workarounds and people processes with technical recovery to address the stated problem.
Question 353 A distribution business relies on a single external warehouse that never joins continuity exercises. What should change? Exercise leadership decisions, stakeholder communication and cross-team coordination Increase validated recovery-point frequency or replication to meet the business RPO Integrate business continuity workarounds and people processes with technical recovery Include critical suppliers and alternative logistics arrangements in BC scenario testing Explanation Correct Answer D:External dependencies can stop business operations despite successful internal recovery. Incorrect Answers A:This option fits a different fact pattern where a company tests only technology failover but ignores executive crisis communications: business continuity success depends on governance and people as well as systems; the current case instead requires include critical suppliers and alternative logistics arrangements in BC scenario testing. B:This option fits a different fact pattern where an application meets uptime requirements but its recovery data can lose 36 hours despite a one-hour RPO: availability targets do not guarantee sufficiently recent recoverable state; the current case instead requires include critical suppliers and alternative logistics arrangements in BC scenario testing. C:BC covers service delivery when applications or facilities are unavailable; this responds to the different circumstance in which a hospital's IT recovery plan restores servers but clinical staff cannot continue care without manual intake forms, while the current case states that a distribution business relies on a single external warehouse that never joins continuity exercises, calling for include critical suppliers and alternative logistics arrangements in BC scenario testing.
Question 354 A company tests only technology failover but ignores executive crisis communications. What should continuity exercises include? Maintain suitably protected copies in a geographically and operationally separate failure domain Integrate business continuity workarounds and people processes with technical recovery Exercise leadership decisions, stakeholder communication and cross-team coordination Include critical suppliers and alternative logistics arrangements in BC scenario testing Explanation Correct Answer C:Business continuity success depends on governance and people as well as systems. Incorrect Answers A:The other scenario states that a company keeps only backups within the same building as its production systems, where one-site disasters can destroy primary data and all local recovery copies; by contrast, the present case requires exercise leadership decisions, stakeholder communication and cross-team coordination. B:BC covers service delivery when applications or facilities are unavailable; although this helps when a hospital's IT recovery plan restores servers but clinical staff cannot continue care without manual intake forms, it leaves the current case's need to exercise leadership decisions, stakeholder communication and cross-team coordination unresolved. D:This option fits a different fact pattern where a distribution business relies on a single external warehouse that never joins continuity exercises: external dependencies can stop business operations despite successful internal recovery; the current case instead requires exercise leadership decisions, stakeholder communication and cross-team coordination.
Question 355 A data room has an electronic lock but mechanical emergency keys circulate without records. What should be improved? Evaluate layered detection coverage and response times across the facility Protect data at rest with appropriate encryption and limited decryption access Control, inventory and audit physical override credentials Establish controlled delivery entry, visitor verification and restricted routes Explanation Correct Answer C:Physical bypass mechanisms require custody just as electronic access does. Incorrect Answers A:For the separate situation in which a high-value lab contains blind spots between CCTV cameras, surveillance design needs effective coverage and actionable monitoring, not camera count alone; here the stated problem requires control, inventory and audit physical override credentials. B:In-transit encryption does not safeguard stored copies or misuse by backup administrators; it is relevant where an engineer uses TLS for transport but leaves archives unencrypted on a shared backup server, whereas the current facts require control, inventory and audit physical override credentials to address the stated problem. D:Physical barriers are ineffective if routinely bypassed by unsupervised entry; it is relevant where a perimeter fence is intact but deliveries enter without inspection or escort, whereas the current facts require control, inventory and audit physical override credentials to address the stated problem.
Question 356 A perimeter fence is intact but deliveries enter without inspection or escort. Which security measure is needed? Control, inventory and audit physical override credentials Evaluate layered detection coverage and response times across the facility Activate documented incident authority, severity criteria and coordinated response roles Establish controlled delivery entry, visitor verification and restricted routes Explanation Correct Answer D:Physical barriers are ineffective if routinely bypassed by unsupervised entry. Incorrect Answers A:This option fits a different fact pattern where a data room has an electronic lock but mechanical emergency keys circulate without records: physical bypass mechanisms require custody just as electronic access does; the current case instead requires establish controlled delivery entry, visitor verification and restricted routes. B:Surveillance design needs effective coverage and actionable monitoring, not camera count alone; although this helps when a high-value lab contains blind spots between CCTV cameras, it leaves the current case's need to establish controlled delivery entry, visitor verification and restricted routes unresolved. C:Clear activation and command reduce delay and conflicting action during disruption; although this helps when a ransomware event disrupts operations and executives disagree about whether an incident has been declared, it leaves the current case's need to establish controlled delivery entry, visitor verification and restricted routes unresolved.
Question 357 A high-value lab contains blind spots between CCTV cameras. What should be assessed? Control, inventory and audit physical override credentials Evaluate layered detection coverage and response times across the facility Establish controlled delivery entry, visitor verification and restricted routes Separate sensitive approvals from execution and maintain independent review Explanation Correct Answer B:Surveillance design needs effective coverage and actionable monitoring, not camera count alone. Incorrect Answers A:This option fits a different fact pattern where a data room has an electronic lock but mechanical emergency keys circulate without records: physical bypass mechanisms require custody just as electronic access does; the current case instead requires evaluate layered detection coverage and response times across the facility. C:Physical barriers are ineffective if routinely bypassed by unsupervised entry; although this helps when a perimeter fence is intact but deliveries enter without inspection or escort, it leaves the current case's need to evaluate layered detection coverage and response times across the facility unresolved. D:Separation of duties constrains unilateral high-impact actions; it is relevant where a service operator approves and deploys their own high-risk production changes without oversight, whereas the current facts require evaluate layered detection coverage and response times across the facility to address the stated problem.
Question 358 An employee receives credible threats while traveling to a high-risk site. What should the company do? Tune the rule using validated context and false-positive evidence while preserving important coverage Apply travel risk review, emergency contact and protective personnel procedures Provide discreet duress signaling and a trained safe-response process Use phishing-resistant authentication and train employees to report push-fatigue attacks Explanation Correct Answer B:Duty of care extends security planning to employee safety outside offices. Incorrect Answers A:Excessive noise lowers response effectiveness and can hide real incidents; it is relevant where a SIEM rule fires thousands of times on harmless administrative activity, whereas the current facts require apply travel risk review, emergency contact and protective personnel procedures to address the stated problem. C:For the separate situation in which a worker under duress is forced to open a controlled facility door, personnel protection requires minimizing harm rather than relying only on door access controls; here the stated problem requires apply travel risk review, emergency contact and protective personnel procedures. D:Repeated MFA prompts can manipulate users; alerting and stronger factors reduce this risk; although this helps when employees receive repeated fraudulent MFA pushes and approve them to stop notifications, it leaves the current case's need to apply travel risk review, emergency contact and protective personnel procedures unresolved.
Question 359 A worker under duress is forced to open a controlled facility door. What should procedures address? Apply travel risk review, emergency contact and protective personnel procedures Document risk, isolate access and agree on a supported remediation or replacement plan Use phishing-resistant authentication and train employees to report push-fatigue attacks Provide discreet duress signaling and a trained safe-response process Explanation Correct Answer D:Personnel protection requires minimizing harm rather than relying only on door access controls. Incorrect Answers A:The other scenario states that an employee receives credible threats while traveling to a high-risk site, where duty of care extends security planning to employee safety outside offices; by contrast, the present case requires provide discreet duress signaling and a trained safe-response process. B:For the separate situation in which a legacy controller cannot be patched because vendor certification would be voided, unsupported patching can create safety risks; compensating controls require accountable acceptance; here the stated problem requires provide discreet duress signaling and a trained safe-response process. C:Repeated MFA prompts can manipulate users; alerting and stronger factors reduce this risk; although this helps when employees receive repeated fraudulent MFA pushes and approve them to stop notifications, it leaves the current case's need to provide discreet duress signaling and a trained safe-response process unresolved.
Question 360 Employees receive repeated fraudulent MFA pushes and approve them to stop notifications. What should awareness and technology address? Use a properly tuned prevention control with safe enforcement and escalation Use phishing-resistant authentication and train employees to report push-fatigue attacks Provide discreet duress signaling and a trained safe-response process Apply travel risk review, emergency contact and protective personnel procedures Explanation Correct Answer B:Repeated MFA prompts can manipulate users; alerting and stronger factors reduce this risk. Incorrect Answers A:Detection-only monitoring does not automatically block attack traffic; it is relevant where a network team runs IDS signatures but no control can stop a confirmed exploit in progress, whereas the current facts require use phishing-resistant authentication and train employees to report push-fatigue attacks to address the stated problem. C:Personnel protection requires minimizing harm rather than relying only on door access controls; although this helps when a worker under duress is forced to open a controlled facility door, it leaves the current case's need to use phishing-resistant authentication and train employees to report push-fatigue attacks unresolved. D:For the separate situation in which an employee receives credible threats while traveling to a high-risk site, duty of care extends security planning to employee safety outside offices; here the stated problem requires use phishing-resistant authentication and train employees to report push-fatigue attacks.
